Another alternative is to use the flatpak version of keepassxc, then use Flatseal (the flatpak permission manager) to reduce what permissions it has (ie. remove network, assign only specific directory access, etc)